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Response to ICO consultation on draft guidance on the right of subject access. 


We have comments only on two aspects of the draft guidance.’ 


Unsubstantiated accusations 

At pages 35-36 the draft suggests that a subject access request (SAR) may be refused as ‘manifestly 
unfounded’ if it is made with malicious intent and is being used to harass an organisation. However, it 
cites as an example a request which makes ‘unsubstantiated accusations’ against the organisation or 
specific employees. 


The reference to ‘unsubstantiated accusations’ may encourage organisations to believe that they can 
refuse a request where the applicant makes what it considers to be an unfounded complaint. For 
example, an applicant may state that the organisation is knowingly failing to comply with its legal 
obligations. The fact that the organisation may consider that comment to be unsubstantiated should 
not permit the request to be refused. 


One of the Information Tribunal’s first decisions under the Freedom of Information Act, in 2005, 
involved a requester who had asked the Inland Revenue for details of action it had taken in relation to 
several examples of what he described as ‘maladministration’ and ‘failed standards’ relating to delays 
in refunding overpaid tax. The Inland Revenue rejected the claim that it had failed to meet standards. 
As a result it considered it held no information about such failures. The ICO upheld the refusal, finding 
that the request was framed in ‘general and subjective terms focussing on the complainant’s opinions 
of the alleged actions of the Inland Revenue’. However, the Information Tribunal found the Inland 
Revenue had previously issued a public apology about the delayed refunds and ruled that the request 
should not have been refused.” In our view, comments of this kind - whether or not demonstrably 
supported by the facts - should not provide grounds for the refusal of an SAR. 


As it stands, the draft guidance may encourage such refusals where a requester makes an allegation 
about an organisation which it considers unfounded. We think the reference to ‘unsubstantiated 
allegations’ should either be dropped altogether or rephrased to make clear that it only applies to 
‘unsubstantiated accusations clearly prompted by malice’. 


1 https://ico. org. uk/media/about-the-ico/consultations/26 16442/right-of-access-draft-consultation-20191204. pdf 
2 EA/2005/0004, Barber and Information Commissioner, 11 November 2005 


Campaign for Freedom of Information Ltd. Registered in England no. 1781526. Registered office as above 


Child abuse 
On page 54 the draft guidance states that an organisation is not obliged to respond to a subject access 
request for child abuse data in specified circumstances if: 


‘complying with the request would not be in the best interests of the individual concerned (ie 
the person the child abuse data relates to)’ 


The reference to the ‘individual concerned’ and ‘the person the child abuse data relates to’ could both 
be taken to refer to the interests of the suspected abuser. It would be clearer to state that there is no 


obligation to comply when doing so would not be in the best interests of ‘the child’. 
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